Configure Azure AD

Log in to Microsoft Azure as an administrative user. Configuration in future steps requires administrative access rights.

Use search to open the App registrations service.

Click New registration and complete the form.

Use search to open App registrations services. Then open the entry for Rancher that you created in the last procedure.

From the navigation pane, click Certificates & secrets.

Click New client secret.

Enter a Description (something like Rancher).

Select the duration from the options under Expires. This drop-down menu sets the expiration date for the key. Shorter durations are more secure, but require you to create a new key more frequently. Note that users won’t be able to log in to Rancher if it detects that the application secret has expired. To avoid this problem, rotate the secret in Azure and update it in Rancher before it expires.

Click Add (you don’t need to enter a value—​it will automatically populate after you save).

You’ll enter this key into the Rancher UI later as your Application Secret. Since you won’t be able to access the key value again within the Azure UI, keep this window open for the rest of the setup process.

From the navigation pane on, select API permissions.

Click Add a permission.

From the Microsoft Graph API, select the following Application Permissions: Directory.Read.All

Return to API permissions in the nav bar. From there, click Grant admin consent. Then click Yes. The app’s permissions should look like the following:

From the left navigation menu, select Authentication.

Under Advanced Settings, select Yes on the toggle next to Allow public client flows.

Obtain your Rancher Tenant ID.

Obtain your Rancher Application (Client) ID.

In most cases, your endpoint options will either be Standard or China. For either of these options, you only need to enter the Tenant ID, Application ID, and Application Secret.

Log into Rancher.

In the top left corner, click ☰ > Users & Authentication.

In the left navigation menu, click Auth Provider.

Click AzureAD.

Complete the Configure Azure AD Account form using the information you copied while completing Copy Azure Application Data.

(Optional) In Rancher v2.9.0 and later, you can filter users' group memberships in Azure AD to reduce the amount of log data generated. See steps 4—​5 of Filtering Users by Azure AD Auth Group Memberships for full instructions.

Click Enable.

Update the permissions of your Azure AD app registration. This is critical.

Log into Rancher.

In the Rancher UI homepage, make note of the banner at the top of screen that advises users to update their Azure AD authentication. Click on the link provided to do so.

To complete the move to the new Microsoft Graph API, click Update Endpoint.

When you receive the pop-up warning message, click Update.

Refer to the tables below for the full list of endpoint changes that Rancher performs. Admins do not need to do this manually.

Admins are encouraged to use the proper restore process if they want to go back. Please see backup docs, restore docs, and examples for reference.

Azure app owners who want to rotate the Application Secret will need to also rotate it in Rancher as Rancher does not automatically update the Application Secret when it is changed in Azure. In Rancher, note that it is stored in a Kubernetes secret called azureadconfig-applicationsecret which is in the cattle-global-data namespace.